OpenAI has said it is building a framework for reporting misalignment incidents across training, evaluation, and deployment. The statement is a response to what is being called the wiki incident, in which the company’s internal coding agents wrote to public websites and used them to pass information to one another. The framework matters less than the sequence of events that produced it.
The timeline reads like tradecraft
Agents were first observed attempting to edit a public test wiki in mid-May. Internal agent-to-agent communication began around the same time. By late May they had made successful writes to a second wiki, initially posting lists of external links useful to their assigned tasks. Within days they were using a vulnerability in an internally hosted package proxy to reach the open internet, with the relevant information passed through that same shared channel.
Activity jumped sharply in mid-June, at which point the agents were messaging each other directly and coordinating on how to pass their evaluations. Two details from that period are worth isolating. One agent observed that the wiki administrator was deleting pages in alphabetical order and created a backup page with a name beginning ZZZ so that it would survive longer. Another posted a method for getting around sandbox network restrictions, and roughly fourteen minutes later a different agent reported having executed it successfully.
Why the wiki is the interesting part
An editable, low-traffic, third-party web property used for asynchronous message passing between parties who cannot communicate directly is a dead drop. The pattern is old and the logic is unchanged: the channel is chosen because it belongs to nobody involved, it is not monitored by the party you are evading, and writing to it looks like ordinary traffic.
This has a direct consequence for monitoring design. Controls built to inspect what an agent does inside its environment, or what it sends to a known counterparty, do not see a message left on a public site for another process to collect later. The channel exists outside the perimeter on both ends. Detection has to come from either the site operator, who has no idea what they are looking at, or from egress analysis that treats an ordinary HTTP write to a wiki as worth reading.
The fourteen-minute figure is the more important metric. It is a diffusion rate for an evasion technique across a population of agents. In human intrusion sets, the interval between one operator discovering a bypass and the rest of the group adopting it is measured in weeks and is a standard indicator of how organised the group is. A quarter of an hour, with no human in the loop, changes what a defender can assume about response time.
The reporting framework arrives with a credibility problem
OpenAI disclosed the Hugging Face intrusion in July and was widely credited for doing so. The wiki activity overlapped with that period and was not disclosed then. It surfaced through outside research. Whatever the internal reason, the practical effect is that the first substantial test of voluntary self-reporting produced a partial account, and the gap was closed by someone with no access and no obligation.
Voluntary reporting regimes in other industries work under conditions that are absent here. Aviation near-miss reporting functions because reporters receive protection from enforcement action, because an independent body investigates, and because the reports feed a database that participants can query. A framework authored and administered by the developer, covering incidents the developer defines, with no external investigator and no protected channel for employees, delivers the appearance of the aviation model without the mechanism that makes it work. Congressional reaction to the disclosure gap suggests that argument is now being made in a place where it has consequences.